dbdcc5c9358be1e718f571b839ddfdf29ffc56d5f260a2d2b81d3c4b38c1b96c

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1482acb95838455cd5c98eb74cfbe68e.html
Size

11KB
MD5

1482acb95838455cd5c98eb74cfbe68e
SHA1

8989d747fea6afb2fc87cad0792608ff42b4d78a
SHA256

dbdcc5c9358be1e718f571b839ddfdf29ffc56d5f260a2d2b81d3c4b38c1b96c
SHA512

2c5c458bfb4c7f2877dab9fa419973fc6431ea049fbf3b5cff73a24be7e7f51aefa834cc24c49f6f872eaacc0eb096e1ed9edb8168d57b85afdee3eff8304b59
SSDEEP

96:uzVs+ux75YtLLY1k9o84d12ef7CSTURj3OlpKIoB9bRcEZ7ru7f:csz75YtAYS/ZQzb76f

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000025638d2656f32846212fd3455466071b4438877cc99b3966c982dc8422adf540000000000e800000000200002000000079cc93d07b05cb29169133bd349084c8c24ff4ecad060c093818b30bf4e5e0be90000000eea1337e61e2326273f73f6d6d5b6091d12f5f82aa5987ac8bbdc04c726cb8e277887ef95bc32cdad38ab4ddc01bcea294d2de6876dbffcaad571bfb08a557cb17e02c349038f57bd6f89ef9ae08406f2626d4ca3924ba5499fbc2a524b9f1050e17d2813ea7e0e06c41efd9e6ec726b4f7387cf674b0b042ba57a3c10185bd68c25a615433eb51081c6448ec78d3c0440000000b611d64f032a0efdb117f93eb31c04d6266941eadb7f27978b758e7ce126bdf50d7069fe83e86360308026185d0863c93048fc8e32216ebc8fb0f3033f681a3b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409870519"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000000aef6b0b294e5a9f814899d0dec16b1510772363fdbaf2137ab07c5a563ca436000000000e8000000002000020000000c10840db500f5505cb0c198e511db19a994ef2ba60056a5e458dd23fd8ec1a53200000005cae070ed8e28a3f0961d639cb3e790a2d921ae4ce420322df66a99c79b9c65f40000000657d0917e75b8a9c6cb393dc4887b609a6fc5d14e399db862394a732522bb8b4024396a285c930b552ae3fb512504010bc5ada4de15a4b480bdcd3d1cad7d8ad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E350E381-A4F5-11EE-971F-6E556AB52A45} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50479dbd0239da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1988	iexplore.exe
1988	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2436	1988	iexplore.exe	28
PID 1988 wrote to memory of 2436	1988	iexplore.exe	28
PID 1988 wrote to memory of 2436	1988	iexplore.exe	28
PID 1988 wrote to memory of 2436	1988	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1482acb95838455cd5c98eb74cfbe68e.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
01ea09156829b7a29aaff60e72215ecd

SHA1
78d3c18fa2167a27ebc10cf8d72a721de0177618

SHA256
5b640ba6d6b6f87885d8278dcef05927a03034b27c3e52f977c0c6566958dadd

SHA512
c2dcba27ce36cf3ba3806c00a41a2e66141d18acee761dd4b2875edf8dd741e0115151f10a0374a1f45569483634d5e97dcad6801d84b389a2243b156d2fd288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1738df4dcb4ae67660124206a3397fdc

SHA1
e349ffb1351535ecac2ea94212c746ca1e6684d3

SHA256
b1dc5dc6dd2a8c5ee9097364a6e0ad2ddc3a26819d51664f6d9724559c3e02f8

SHA512
51a51f5755b5a31df270ba3413c11e070746fb918dcdd853212881247f7001d4d90df0b68c5ef332eedfa33265dc8ebc47f2f57b6e2e854269cae650b24286bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78e5862e4ed228f521d03a021f30abb4

SHA1
3da0affe4efa7b9573c946aed16f536709e5c249

SHA256
46a26b00e6369dddb752befbc6bc069cb8d6c8d01e352e72b46443a357554102

SHA512
f4ef9882dbfb9e0df5b018334f1879b6a25ac9a91039bbc4f636656cc4ea681dc93f9d706d5d8b7d34c183d92644edda3517065e6840c0dc576e1200f25cd7ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c57ca6af2826446d67e09a19672e67da

SHA1
f1237a1571c03cdaebc2e95088f597110234e892

SHA256
2fe513cafcce811965c629e61be6a708d8c4fcb4a36be4229589a34b6b927347

SHA512
74b41de92aaf902c845ecbc719853dab2645cba97da4bffddafc38da0e3c4ea122c6432b235ccf058d948047f48abd85fbfb5dffa478ba5424fcde86bd7218f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
60ed23f3c7a90a92c5d2aea1c8880261

SHA1
0e23b2ec700529e5433049cc2564916f647c4e44

SHA256
1b39874c6d255903b05cba7885439f9fd277efd5ed7aa1cfa5824f2bef10a058

SHA512
0012531e895ebc65e59aa5f66b34097176be76f4c97e1de3b37c2c04708d282400942c589c67f686adc9a9b13787386b7bb2cb54de19e90386de5c906fd680db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9f9fc1aae6436bf91bd66a5a69446f37

SHA1
554fe0946f6185477abc805759e30c0dd341ff99

SHA256
1a7d0daff0d0a17173b485202a3c389911edf8f84985b2f68d4ad9e261438837

SHA512
1c47508953a3100ad769f3960c448b2cc607dd49e3ed7e2cbd3b2ca88eb7fb7012a6e3da35cf76e07426257b8cca84aa7b5c2388081c1402a926fba16f25f716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
396d255d64bf9d46ddf0abe82af879b5

SHA1
a205012fd999d31ad8a9703b9ca8ae582a764705

SHA256
9931ca60a049675241942916db307601ebfbd2cf088a977b293f29de656cfc4c

SHA512
5d40ecb570329d4d3eaef6cf858744b123a1ba59fde554dd60763acf7a8f60cf7a8a0d37ed37377037b84bfccc99956b73d1a7ffab9b807323de6c9455c120b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7429ac1cf74bc7aa11bd293d401112e

SHA1
589dcf98ed44fef698e9663dc2f89ecb85cb8b1d

SHA256
a18d84472a6f28dc50a94d69685cbab6247eb09ea0b52e5cd62cad325d8a6074

SHA512
8f8e26ea4400320959f6e1055a6d20b8fb1af395174f1af2459cb550ff00d4db069083f921f8e2b0a0159b9adb09fc9579b86be0fa8ea15bd7a74b8e0c377ffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8545688ac0bae5b512c05f4e1dd76f45

SHA1
8271f00ce02acdf78ca386a624417f79f9c1ccf0

SHA256
2a5f18c6704f27f655ab00d39475374fb37e1bbf249cbfcf1f2f0cc4f4aa1514

SHA512
1763df1cafc347a215c90f5f9e167b1ddc3b46d8b9240b6fa4341456064d46f389c6b3f8785802a82e8b4d94878330401c67cf2329c2d650c20535dba8ffa046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
715d8d90b1d9cd8ecba038e03b003365

SHA1
76b97a8b570e3e4a1f5df176376050a81a06cd0f

SHA256
2b6f64852caa88b91541719f3afbd9d0bd51824fec83ed276e6cfbcc1fed3dc8

SHA512
f70aa14eae8f570557e46d1d6c11c6683109044e90d809c2bf2bfddde91a42ef0dacce9018c40e6cc8acb0e90be55692d26cae50c10a4a73ce5b9e60186fbea6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E07.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA309.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit